Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Found hooked up to my router

reddit.com

Post reply on HN
Print view View original

181–190 of 358 posts

Re: Found hooked up to my router

#181

Post by Merad »

sjwright wrote: post #167
Merad wrote: post #106

Earlier quoted context omitted.

At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.

So these IT genuises at a Fortune 500 company were clever enough to test their employees' computer security acumen (and get the predicted result) but they weren't clever enough to simply block all use of USB mass storage devices on their corporate operating system distribution? Surely by now all corporate desktops should be configured to not respond to any USB devices other than the generic HID for mouse and keyboard…

I don't think I've ever heard of a company that actually does this in practice. I suspect it ends up simply being more trouble than it's actually worth. I know at that company the list of approved device would probably end up being dozens of pages long... and yeah, thumb drives and USB hard drives were used a decent amount, especially outside of IT.

Re: Found hooked up to my router

#182

Post by ObsoleteNerd »

dabockster wrote: post #103
code4tee wrote: post #98

In the days when USB sticks were more common it was an easy tactic for someone to drop one in a company parking lot labeled “salary data” and with almost certainty that thing would get plugged into a device on the corporate network. The biggest security vulnerability in most cases is still users doing dumb things.

USB sticks are still pretty common.

As are USB stick attacks.

Re: Found hooked up to my router

#183

Post by earenndil »

osrec wrote: post #177
Pxtl wrote: post #171

Earlier quoted context omitted.

Yes, but browsers give huge warnings about password fields on non-SSL sites. Password in the clear won't happen with any major website.

Do they? I don't think so... Try http://login.ebiquity.com Do you see any warnings in your browser? I see no warnings in Chrome.

This is shown in firefox: https://files.catbox.moe/srdxhe.png

Re: Found hooked up to my router

#184

Post by earenndil »

mynegation wrote: post #161
illumin8 wrote: post #143

Earlier quoted context omitted.

Product idea: internal condoms for every USB port on a business computer. Let employees charge their phones in USB ports or plug whatever in, data wires never connect - problem solved: Employees can charge their ${device} without risking security compromise of the host workstation.

Which is totally redundant because that can be done on operating system level, but hey, bottled water is a huge industry too.

USB drivers can still be vulnerable, though.

Re: Found hooked up to my router

#185

Post by earenndil »

joeframbach wrote: post #140
adamconroy wrote: post #63

I don't see how this 'man' in the middle could actually intercept passwords, except for http, but who runs auth over http anyway. For https, the 'man' would have to substitute its own certificate and then the browser / client software wouldn't trust the cert/domain combination without the end user being extremely stupid (and knowledgeable enough to achieve the stupidity).

You type in http://yourbank.com , your bank respomds with a 301 to https, but this helpful router instead takes you to its phishing site. Lots of people wouldn't notice.

Or it redirects you to https:// yöurbank .com/, and you see the green padlock and think nothing more of it.

Edit: made HN not mangle the link.

Re: Found hooked up to my router

#186

Post by hguant »

amckinlay wrote: post #115
krn wrote: post #53

One comment in that thread[1] gives a full explanation of what such a Raspberry Pi device hooked up to the router can do: forward all the network traffic, replace router's stock firmware with its own, install software on the network connected devices via known vulnerabilities, spoof websites by acting as custom DNS server. In my opinion, it looks like "a Pi-hole[2], but for phishing". [1] https://www.reddit.com/r/wha…

I still don't understand how this device could steal login details. Everything should be encrypted and authenticated through PKI when using any website that accepts login details. Whenever I visit a website with an expired certificate, for example, Chrome gives me a big red warning banner before allowing me to continue to the site.

>Everything should be encrypted and authenticated through PKI when using any website that accepts login details.

Yes, everything SHOULD be like this. I should be able to trust my neighbors and leave my doors unlocked as well, and I should be able to have faith in my elected officials. And yet...

The other issue is that you can connect to a website that implements HTTPS correctly, and still be borked if that site doesn't implement HSTS properly - there are tools that implement HTTPS downgrading on Kali.

>I still don't understand how this device could steal login details...Whenever I visit a website with an expired certificate, for example, Chrome gives me a big red warning banner before allowing me to continue to the site.

The problem comes when your corrupted router messes with DNS and sends you to https://evil.chase.com, which has a pixel perfect mock up of a chase bank login screen, and a perfectly valid cert.

Re: Found hooked up to my router

#187

Post by kalleboo »

osrec wrote: post #177
Pxtl wrote: post #171

Earlier quoted context omitted.

Yes, but browsers give huge warnings about password fields on non-SSL sites. Password in the clear won't happen with any major website.

Do they? I don't think so... Try http://login.ebiquity.com Do you see any warnings in your browser? I see no warnings in Chrome.

Safari shows a red "Website not secure" in the address bar like this https://i.imgur.com/6DXzZ8G.png

Re: Found hooked up to my router

#188

Post by ChuckMcM »

A somewhat dated reminder that "Social engineering is the best engineering." when it comes to getting around security blocks. As Natasha said to Boris, "I said system is 'Idiot proof' not 'Moose proof'!"

Re: Found hooked up to my router

#189

Post by romwell »

earenndil wrote: post #183
osrec wrote: post #177

Earlier quoted context omitted.

Do they? I don't think so... Try http://login.ebiquity.com Do you see any warnings in your browser? I see no warnings in Chrome.

This is shown in firefox: https://files.catbox.moe/srdxhe.png

Sooooo easily ignorable.

Re: Found hooked up to my router

#190

Post by MrEldritch »

dabockster wrote: post #101
krn wrote: post #53

One comment in that thread[1] gives a full explanation of what such a Raspberry Pi device hooked up to the router can do: forward all the network traffic, replace router's stock firmware with its own, install software on the network connected devices via known vulnerabilities, spoof websites by acting as custom DNS server. In my opinion, it looks like "a Pi-hole[2], but for phishing". [1] https://www.reddit.com/r/wha…

It's amazing how many people forget that Raspbian is still Linux under all the Wolfram and Raspberry Pi stuff. So you essentially have a tiny computer that can be plugged into almost anything you can program for.

Really, people forget that Raspbian might just possibly be related to Debian?

>doubt

Post reply on HN